Threat Intelligence Directory

Malware family identifying osx.lador. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.kuiper. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.komplex. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.kitmos. Origin and technical characteristics tracked via Malpedia.

According to SentinelOne, KeySteal targets files with the .keychain and keychain-db file extensions in the following locations.

Malware family identifying osx.keydnap. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.keranger. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.kandykorn. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.jokerspy. Origin and technical characteristics tracked via Malpedia.

According to Patrick Wardle, this malware persists a python script as a cron job. Steps: 1. Python installer first saves any existing cron jobs into a temporary file named '/tmp/dump'. 2. Appends its new job to this file. 3. Once the new cron job has been added 'python (~/.t/runner.pyc)' runs every minute.

Malware family identifying osx.interception. Origin and technical characteristics tracked via Malpedia.

RAT. Functionality like ExecShell, GetFileList/SendFile/DownloadFile, Socks5, PortmapManager/GetConn/SendConn. Transport also supports Quic. Variants in GO.

The threat was a multi-stage malware displaying a decoy that appeared to the victim as a Chinese language article on the long-running dispute over the Diaoyu Islands; an array of erotic pictures; or images of Tibetan organisations. It consisted of two stages: Revir was the dropper/downloader and Imuler was the backdoor capable of the following operations: - capture screenshots - exfiltrate files to a remote computer - send various information about the infected computer - extract ZIP archive - download files from a remote computer and/or the Internet - run executable files

Malware family identifying osx.hz_rat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.hloader. Origin and technical characteristics tracked via Malpedia.

According to Malwarebytes, The HiddenLotus "dropper" is an application named Lê Thu Hà (HAEDC).pdf, using an old trick of disguising itself as a document - in this case, an Adobe Acrobat file.

Malware family identifying osx.golangghost. Origin and technical characteristics tracked via Malpedia.

According to PCrisk, GMERA (also known as Kassi trojan) is malicious software that disguises itself as Stockfolio, a legitimate trading app created for Mac users. Research shows that there are two variants of this malware, one detected as Trojan.MacOS.GMERA.A and the other as Trojan.MacOS.GMERA.B. Cyber criminals proliferate GMERA to steal various information and upload it to a website under their control. To avoid damage caused by this malware, remove GMERA immediately.

This multi-platform malware is a ObjectiveC written macOS variant dubbed GIMMICK by Volexity. This malware is a file-based C2 implant used by Storm Cloud.

Fullhouse (AKA FULLHOUSE.DOORED) is a custom backdoor used by subsets of the North Korean Lazarus Group. Fullhouse is written in C/C++ and includes the capabilities of a tunneler and backdoor commands support such as shell command execution, file transfer, file managment, and process injection. C2 communications occur via HTTP and require configuration through the command line or a configuration file.

Malware family identifying osx.fruitfly. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.frostyferret. Origin and technical characteristics tracked via Malpedia.

According to Proofpoint, FrigidStealer FrigidStealer uses Apple script files and osascript to prompt the user to enter their password, and then to gather data including browser cookies, files with extensions relevant to password material or cryptocurrency from the victim’s Desktop and Documents folders, and any Apple Notes the user has created.

Malware family identifying osx.friendlyferret. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.flexibleferret. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.flashback. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.finfisher. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.failytale. Origin and technical characteristics tracked via Malpedia.

According to PcRisk, EvilQuest (also known as ThiefQuest) is like many other malicious programs of this type - it encrypts files and creates a ransom message. In most cases, this type of malware modifies the names of encrypted files by appending certain extensions, however, this ransomware leaves them unchanged. It drops the "READ_ME_NOW.txt" in each folder that contains encrypted data and displays another ransom message in a pop-up window. Additionally, this malware is capable of detecting if certain files are stored on the computer, operates as a keylogger, and receives commands from a Command & Control server.

Malware family identifying osx.evilosx. Origin and technical characteristics tracked via Malpedia.

According to PCrisk, ElectroRAT is a Remote Access Trojan (RAT) written in the Go programming language and designed to target Windows, MacOS, and Linux users. Cyber criminals behind ElectroRAT target mainly cryptocurrency users. This RAT is distributed via the trojanized Jamm, eTrader, and DaoPoker applications.

Eleanor comes as a drag-and-drop file utility called EasyDoc Converter. This application bundle wraps a shell script that uses Dropbox name as a disguise and installs three components: a hidden Tor service, a Pastebin agent and a web service with a PHP-based graphical interface. The Tor service transforms the victim’s computer into a server that provides attackers with full anonymous access to the infected machine via Tor-generated address. The Pastebin agent uploads the address in encrypted form to the Pastebin website where the attackers can obtain it. The web service is the main malicious component that provides the attackers with the control over the infected machine. After successful authentication, the interface offers several control panels to the attackers, allowing them to do the following actions: - Managing files - Listing processes - Connecting to various database management systems such as MySQL or SQLite - Connecting via bind/reverse shell - Executing shell command - Capturing and browsing images and videos from the victim’s webcam - Sending emails with an attachment

Malware family identifying osx.eggshell_rat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.dummy. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.dockster. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.dazzle_spy. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.darthminer. Origin and technical characteristics tracked via Malpedia.

According to PCrisk, Dacls is the name of a remote access Trojan (RAT), a malicious program that allows cyber criminals to control infected computers remotely. Research shows that this malware is tied to Lazarus Group (a group of cyber criminals) and targets Linux and the Windows Operating System. Typically, cyber criminals use RATs to steal sensitive, confidential information, infect systems with other malware, and so on. In any case, no RAT is harmless and should be uninstalled immediately.

Malware family identifying osx.cthulhu_stealer. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.crossrider. Origin and technical characteristics tracked via Malpedia.